Cybersecurity News: 11 November 2026

Baker Tilly is notifying clients that an unauthorized actor obtained personal information about them and their dependents from a third-party service provider platform. The firm learned of the incident on September 6 and completed its review on October 28, but did not name the provider or give a global count. Texas records show 10,456 individuals in the state were affected, with Social Security numbers, names and addresses exposed.

ConnectWise is investigating an active campaign in which attackers use compromised ScreenConnect environments to deploy rogue ScreenConnect clients to customer devices. Huntress has identified six compromised MSPs and 286 affected endpoints across 47 organizations, with numbers rising. Telemetry points to compromised credentials and hijacked support sessions, and ConnectWise urged partners to avoid interactive sessions with suspected devices.

Notion disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed customer AI chat transcripts in a small number of workspaces. The breach occurred when an attacker accessed Fireworks' development environment via a third-party cloud provider, compromising resource metadata and datasets.

Notion responded by cutting off traffic to Fireworks and deleting all data from the vendor's systems, affecting less than 1% of its users.

Vates says a threat actor is exploiting a critical Xen Orchestra authentication flaw to gain administrator privileges and potentially take over XCP-ng hosts as root. The bug affects releases before 6.9.2 and 6.10.1 and can expose reusable login token IDs. A second exploited flaw allows malicious VM imports, with a fix still in development, and Vates recommends reinstalling confirmed compromised instances.

Arctic Wolf says attackers used Alibaba Cloud instances of AntiFox, an open-source AI pentesting platform, to exploit web services and harvest AWS secrets. In one intrusion, an ASPX webshell on an IIS server let attackers run commands, read configuration files and probe AWS APIs with valid IAM identities and EC2 roles.

Some attempts were blocked, but production secrets were obtained and S3 objects were read, copied and deleted in another incident.

Maersk confirmed that attackers breached a legacy IT system acquired from LF Logistics, stealing data from a platform that holds information for other logistics companies. The WhiteArmor ransomware gang claimed responsibility, demanding $5 million in bitcoin and threatening to release 100GB of data, including over 16,000 driver passwords stored in plain text.

Maersk stated that the incident is isolated to a local system and that no sensitive data has been disclosed, though the investigation is ongoing.

AI-powered attacks cost small Indian NBFCs nearly 300 crore rupees in two months, according to a report. A Delhi-based lender allegedly lost 7.5 crore rupees in one attack and 7.25 crore rupees days later. CERT-In and CSIRT-Fin warned that payment API flaws and AI toolkits can let attackers move from compromise to stolen funds within hours.

Git released updates for six vulnerabilities that can let attackers execute code, write to unintended files or corrupt memory when processing malicious repositories or input. One integer truncation flaw can let an attacker run code during a recursive clone by replacing a submodule .git file with a symbolic link. Other flaws affect protocol v2 references, GPG signature handling, binary patches, merge memory calculations and fast import.

Cynet said attackers used PowerShell reverse shells against several EU based Qlik Sense servers in October 2026, in activity overlapping a 2023 CACTUS ransomware campaign. The reverse shells were blocked, but testing showed they could enable persistence and look for Apache ActiveMQ processes or read Linux password files. A second variant attempted to install OpenSSH and create a scheduled task that would run a reverse shell every five minutes.

Asus published an advisory for four high and medium severity router firmware vulnerabilities that could allow attackers to run arbitrary commands with root privileges or crash the device. Zoom patched two unauthenticated privilege escalation flaws in Workplace for Windows, including a critical bug rated 9.6. Cisco and SonicWall also removed root certificates affected by compromised eMudhra intermediate certificates.

Citrix and Ivanti patched 19 vulnerabilities, including a critical SQL injection flaw in Ivanti Endpoint Manager that could allow unauthenticated remote code execution and a critical missing authentication flaw in Cloud Services Application. Citrix fixed six XenServer defects, including a high severity bug that could let attackers infer the Pool Secret and compromise the host. Ivanti said it has no evidence the flaws were exploited in the wild.

Poland temporarily shut down ePUAP, a nationwide platform for submitting official documents and accessing public services, after detecting and stopping a cyberattack. Officials said the platform was taken offline as a precaution and that the Central Information Technology Center's infrastructure remained secure. Authorities have not said how the attack was carried out, who was responsible, or whether data was stolen.

N-able released hotfixes for zero-day vulnerabilities in its N-central remote monitoring and management platform, which were publicly disclosed over the weekend. The company took all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific until patches could be applied. Threat intelligence firm Defused reported that attackers have already started scanning for vulnerable systems.

Fortinet released 89 security advisories addressing nearly 100 vulnerabilities, including 17 critical-severity issues that could allow arbitrary code execution. The company integrated AI models into its testing to find defects faster, giving customers time to prioritize upgrades. FortiMail received the largest batch of critical fixes, followed by FortiAuthenticator and FortiOS.

eMudhra revoked eight additional intermediate certificate authorities after discovering that a Python script used in a key ceremony truncated their private keys to one byte. The company had previously declared these CAs unaffected, but the script's round-trip process weakened the keys. Six of the revoked CAs were for website certificates and two for code signing.

Hudson Rock reported that Remus Stealer is selling a $1,000 per month Gmail feature that allegedly gives criminals continuous access to a victim's inbox. The tool is said to keep reading mail after password changes, closed browsers and revoked sessions, using a stolen-device record. If accurate, attackers could read password reset links and verification codes to reach other accounts tied to the email address.

SANS found that 34% of organizations running OT or industrial control systems recorded at least one cyber incident in the past year, up from 22% last year. Ransomware and shared IT/OT credential and identity compromise were most cited incident types, while IP theft rose from 6% to 31%. Only 13% reported full IT/OT visibility, and 58% said they would shut down or be unable to operate within a year if their primary automation vendor disappeared.

CISA added a high-severity Cisco BroadWorks vulnerability to its Known Exploited Vulnerabilities catalog after threat actors began using it to read sensitive configuration information. The flaw, tracked as CVE-2026-20320, allows unauthenticated remote attackers to exploit improper XML parsing.

Malbear Labs reported that a Chinese-speaking threat actor used an AI intrusion harness to target a European telecommunications provider and at least 13 organizations using its services.

A Latvian branch of CSCTelecom left a database of more than 125 million SMS messages exposed, with records from October 2022 to September 2026. The real time database meant attackers could have intercepted authentication codes, password reset links and private information before recipients saw them.

The leak included messages from banks, medical institutions, shopping sites and government organizations, and affected people in Lithuania and Estonia.

Intel and AMD published more than 50 security advisories covering over 200 vulnerabilities, with fixes available for most but not all. Intel's 24 advisories describe just over 100 flaws, including three critical and 20 high severity issues, with one TDX Migration Trust Domain bug that could allow remote code execution. AMD's 29 bulletins and two briefs cover roughly 100 CVEs, none critical, and some fixes are still months away.

SEGA said a breach at Arara Inc., its newsletter delivery provider, exposed 2,196,044 customer email addresses and 92,273 distribution items. Arara said attackers accessed 97 servers between October 28 and 31, compromising about 77 million email addresses from about 380 companies. SEGA said its leaked data did not include names, dates of birth, addresses, phone numbers, credit card numbers or login credentials, but warned of phishing.

Threat actors are exploiting two recently patched Barracuda vulnerabilities that can be chained to bypass authorization controls and gain root access. CISA added both flaws to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch within three days. The bugs affect Barracuda Email Security Gateway and other appliances.

ENISA found 45% of surveyed EU IT service management providers took over three months to patch critical systems, and 43% ran no cybersecurity assessment in a full year. Slow patching at one provider can expose customers that depend on it. The EU Cybersecurity Index scores the EU at 71.53 out of 100, but a changed framework prevents comparison with 2024. ENISA kept the threat level substantial for the two years to July 2026.

ProjectDiscovery found nearly half of security teams at organizations with 5,000 or more employees close or deprioritize findings without full verification, citing time. Among teams that skip full verification, 57% say at least three of four findings they check are real. Mandiant says attackers took an average of 7 days to exploit a vulnerability in 2025, down from 63 in 2018.

Criminals are using leaked DarkSword and Coruna kits to infect iPhones via Instagram ads, compromised sites and traffic brokers. One variant started when an Instagram ad loaded. A hidden page checked for Safari on iOS 18.4.0 to 18.7.2 before launching DarkSword. The kits can steal Keychain credentials or find crypto recovery phrases, so personal phones used for work email, messaging or remote access may expose company services.

One Identity introduced Active Roles 8.6, a cumulative release that fixes an RSTS configuration security issue and supersedes versions 8.3, 8.4 and 8.5. It adds REST API capabilities and Redistributable Secure Token Server support for API access and SAML 2.0 federated authentication. The update centralizes administration across Active Directory, Microsoft Entra ID and Microsoft 365.

Commvault launched Recovery Studio, an automated runbook-driven product for restoring applications, identities, configurations, infrastructure dependencies and datasets. The company said it targets early access in December and general availability in coming months, and that conventional recovery to minimal operation averages 28 days. Analysts praised the effort but said IT teams must keep a current dependency map.

Finite State announced a $27 million Series C led by private funds managed by The O.H.I.O. Fund, with participation from CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners. Its AI platform analyzes device software and firmware to find known and zero-day vulnerabilities. The funding will expand global operations and autonomous capabilities as regulators expect connected products to be secure by design.